Splunk Search

How to get function for today's month/day/year?

dan_growler
Engager

I am writing a search query that looks for hosts that have appeared for the first time today and their count.

Here is what I was thinking:

< my search > | stats count last(date_year) AS first_year last(date_month) AS first_month last(date_mday) AS first_day BY host | where first_year=today's year AND first_month=today's month AND first_day=today's day

Is there a function in Splunk that returns today's year, month and day that would make the above search query work?

Labels (1)
Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Probably simpler to use:

... | stats min(_time) as firsttime by host | where firsttime > relative_time(now(),"@d")

View solution in original post

custommarketins
New Member

I think that this could help.

=DATE(2023, 6, 21) - returns a serial number corresponding to 21-June-2023.

=DATE(YEAR(TODAY()), MONTH(TODAY()), 1) - returns the first day of the current year and month.

=DATE(2015, 5, 20)-5 - subtracts 5 days from May 20, 2015.

For additionally you can visit here.

0 Karma

straitsresearch
Engager

I think this might be helpful.

=DATE(2015, 5, 20) - returns a serial number corresponding to 20-May-2015.

=DATE(YEAR(TODAY()), MONTH(TODAY()), 1) - returns the first day of the current year and month.

=DATE(2015, 5, 20)-5 - subtracts 5 days from May 20, 2015.

For additionally you can visit here.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Probably simpler to use:

... | stats min(_time) as firsttime by host | where firsttime > relative_time(now(),"@d")

Ayn
Legend

Excellent idea. Didn't even know about that function 🙂

0 Karma

Ayn
Legend

You can use the functions eval and strftime. Either pull out the year, month and day separately:

< your search > | eval todaysyear=strftime(now(),"%Y") | eval todaysmonth=strftime(now(),"%m") | eval todaysday=strftime(now(),"%d") | stats count last(date_year) AS first_year last(date_month) AS first_month last(date_mday) AS first_day BY host | where first_year=todaysyear AND first_month=todaysmonth AND first_day=todaysday

Or concatenate them together if you want less evals:

< your search > | eval todaysdate=strftime(now(),"%Y%m%d") | stats count last(date_year) AS first_year last(date_month) AS first_month last(date_mday) AS first_day BY host | where first_year.first_month.first_day=todaysdate

gkanapathy
Splunk Employee
Splunk Employee

This works, but really it's probably easier to just do the math directly using the epoch time, which is just seconds. All you need is to compare the time of appearance of the host with relative_time(now(),"@d"). If it's less, then it's old, if it's greater, then it's new. No need for all the string conversions.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...